Three diagnostic questions to ground your next decision.
The gap in your current email security is not a mystery. It is architectural. Use these three questions to identify where your current stack is going blind, and what architectural capability you need to fill the gap.
Which category hurts most?
- Credential Harvesting: AiTM, quishing, helpdesk impersonation. Defeats reputation filtering and sandbox analysis. Pre-auth phase.
- Malware Delivery: HTML smuggling, QR codes, CAPTCHA gates. Defeats sandbox and URL detonation. Late pre-delivery phase.
- Business Email Compromise: Account takeover, thread hijack, multi-persona consensus. Defeats behavioral baselines. Post-delivery fraud.
- Spam / Bulk Fraud: Sextortion, pig butchering, targeted advance fee. Defeats pattern matching on commodity attacks. High FP cost.
- Disinformation: Fabricated documents, narrative seeding, market manipulation. Defeats rule-based scanning. Content authenticity problem.
- Infrastructure Abuse: Account hijack for downstream, LOTS via legitimate infrastructure. Defeats reputation filtering. Cross-tenant problem.
What detection capability are you missing?
- Active retrieval post-click: Can your system follow a link through CAPTCHA gates, proxy redirects, and anti-sandbox barriers to see what the link actually resolves to?
- Behavioral delta at account level: Can your system detect when a known-good sender's behavior shifts (outbound message volume, recipient set, phrasing)? Or just flag first-contact anomalies?
- Cross-tenant correlation: Can your system detect compromised partner accounts sending the same payload to multiple organizations? Or are you seeing each attack in isolation?
- Infrastructure intelligence: Can your system verify whether claimed legitimate infrastructure (SendGrid, SharePoint, Zoom) is actually being used by the claimed sender? Or do you blocklist it, breaking legitimate users?
- Reasoning over ambiguous signals: When pattern matching, ML, and LLM all disagree, can your system request more evidence and adapt its confidence based on what it finds? Or does it require consensus?
What does your current vendor measure?
- Ask them which attacks they are designed around: Not "do you use behavioral ML?" but "is your architecture built on behavioral ML as the primary defense, or is it a secondary layer?"
- Ask them how they measure false positives: Do they count "emails correctly let through" as a success metric? Or "emails challenged for additional verification, then let through"?
- Ask them about the 44 attacks on this page: Which ones does their system catch reliably? Which ones do they lose? On which ones do they require human review?
- Ask them for their Layer 3 answer: If the payload is a phone number, a video call, or an SMS, what is the architectural answer? Or is that out of scope?
We built this taxonomy and simulator because no vendor ships a credible story about how they handle all three layers. Use this page to ground your evaluation: pick the five attacks that hurt you most, run the simulator on each one, and ask your vendor how they perform on exactly those patterns.
EDR is not Email Security
EDR and email security are orthogonal problems. 87% of the 44 attacks on this page have no on-endpoint execution, no process creation, and no file write. EDR cannot see them. A compromised email account is an endpoint problem only after the attacker gains access through the email. The gate-keeping happens in the email layer.
Do you have an AI gap? Find out what’s getting through.
See which generations of defense you’re running and what it takes to close the gap. Two minutes. No signup. Nothing changes in your environment.